CVE-2026-47735

Arc (Basekick Labs) is an open-source SQL-native time-series database for telemetry. Prior to 26.06.1 , its user-SQL validator (internal/api/query.go:ValidateSQLRequest) blocked only read_parquet( and arc_partition_agg( via regex denylist, while the broader DuckDB I/O function family (read_csv_au...

CVE-2026-53487

Kite, a Kubernetes dashboard, has an authenticated cluster RBAC bypass in the /api/v1/overview endpoint prior to version 0.12.3. The root cause is that the overview route is registered before middleware.RBACMiddleware(), and the GetOverview handler only verifies len(user.Roles) > 0 rather than...

CVE-2026-67567

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources CRs, to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated...

CVE-2026-67567 Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources CRs, to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated...

CVE-2026-67567

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources CRs, to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated...

CVE-2026-14953

Frauscher Sensortechnik's FDS102 device (R2) has improper RBAC enforcement at /api/user/fetch-all.php, allowing a low-privileged remote attacker to enumerate all users and identify privileged accounts (CVSS 5.3 MEDIUM). No patch version or in-the-wild exploitation details are provided in the docu...

CVE-2026-14953 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is Missing Authorization due to improper enforcement of role-based access control

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php...

CVE-2026-14949

Frauscher Sensortechnik's FDS102 system (for FAdC/FAdCi R2) exposes an unauthenticated /api/user/add.php endpoint that accepts arbitrary role values; a low-privileged attacker with a valid session can create accounts at the highest privilege level, enabling privilege escalation. CVSS 3.1 scores t...

CVE-2026-73499 vulnerabilities

Vulnerabilities for packages: kine, dapr...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: spicedb-operator, vcluster, flux-helm-controller, flux-notification-controller, kapp-controller, helm-operator, cloud-provider-gcp-cloud-controller-manager, kubernetes-csi-external-resizer, tekton-chains, emissary, kuma, kubernetes, datadog-operator, telegraf,...

CVE-2026-76370

In Splunk SOAR versions below 8.6.0, an authenticated user with restricted tenant access could use the Representational State Transfer REST API to view the names and identifiers of tenants that fall outside the role scope for that user. The vulnerability is possible because Splunk SOAR does not...

CVE-2026-16874

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain root privileges due to improper enforcement of RBAC authentication roles...

EUVD-2026-62874

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain root privileges due to improper enforcement of RBAC authentication roles...

CVE-2026-16874 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain root privileges due to improper enforcement of RBAC authentication roles...

CVE-2026-16874

CVE-2026-16874 affects IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 . The root cause is improper enforcement of RBAC authentication roles , which allows a local attacker with low privileges to escalate to root . The CVSS 3.1 score is 7.8 (HIGH) with full impact on confidentiality, integrity, and ava...

CVE-2026-70496

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...

EUVD-2026-62678

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...

CVE-2026-70496

The search-v2-operator ClusterRole grants cluster-admin-equivalent privileges (impersonation, RBAC write, CSR approval, ManifestWork management), enabling privilege escalation. No exploitation details or patch versions are provided in the documents; monitor Red Hat advisories for remediation guid...

CVE-2026-70496

A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control RBAC configurations, approve Certificate Signing Requests CSRs, and manage ManifestWork. This grants...

CVE-2026-71470

A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource CR editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount...